From 0d0c9314a1a6e7bc11ca79b10a1d6072ecbc9608 Mon Sep 17 00:00:00 2001
From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Date: Fri, 17 Jul 2026 22:15:27 +0000
Subject: [PATCH] test(s3_v2): cover sync upload path for KMS key id header

---
 tests/test_litellm/integrations/test_s3_v2.py | 42 +++++++++++++++++++
 1 file changed, 42 insertions(+)

diff --git a/tests/test_litellm/integrations/test_s3_v2.py b/tests/test_litellm/integrations/test_s3_v2.py
index 344b65eeab8..86532f0d4b2 100644
--- a/tests/test_litellm/integrations/test_s3_v2.py
+++ b/tests/test_litellm/integrations/test_s3_v2.py
@@ -1465,6 +1465,48 @@ async def test_async_upload_omits_kms_key_id_header_when_not_configured():
     assert "x-amz-server-side-encryption-aws-kms-key-id" not in headers
 
 
+def test_sync_upload_sets_kms_key_id_header_when_configured(monkeypatch):
+    """The sync upload path must also send the KMS key id header when configured."""
+    from unittest.mock import MagicMock
+
+    from litellm.types.integrations.s3_v2 import s3BatchLoggingElement
+
+    logger = S3Logger(
+        s3_bucket_name="test-bucket",
+        s3_aws_access_key_id="test-key",
+        s3_aws_secret_access_key="test-secret",
+        s3_region_name="us-east-1",
+        s3_server_side_encryption="aws:kms",
+        s3_server_side_encryption_kms_key_id="arn:aws:kms:us-east-1:123456789012:key/abc-123",
+    )
+
+    test_element = s3BatchLoggingElement(
+        s3_object_key="2025-09-14/test-sync-kms.json",
+        payload={"test": "sync-kms"},
+        s3_object_download_filename="test-sync-kms.json",
+    )
+    _require_non_security_md5(monkeypatch)
+
+    response = MagicMock()
+    response.status_code = 200
+    response.raise_for_status = MagicMock()
+    mock_sync_client = MagicMock()
+    mock_sync_client.put.return_value = response
+
+    with patch(
+        "litellm.integrations.s3_v2._get_httpx_client",
+        return_value=mock_sync_client,
+    ):
+        logger.upload_data_to_s3(test_element)
+
+    headers = mock_sync_client.put.call_args.kwargs["headers"]
+    assert headers["x-amz-server-side-encryption"] == "aws:kms"
+    assert (
+        headers["x-amz-server-side-encryption-aws-kms-key-id"]
+        == "arn:aws:kms:us-east-1:123456789012:key/abc-123"
+    )
+
+
 def test_s3_server_side_encryption_kms_key_id_read_from_callback_params():
     """s3_server_side_encryption_kms_key_id can be configured via s3_callback_params."""
     import litellm